RE: NT Compromise -- Update -- SRC PORT: 53 traffic

From: Alvin Oga (alvin.secat_private-Consulting.com)
Date: Tue Dec 25 2001 - 18:03:47 PST

  • Next message: Jose Nazario: "Re: some "scanned with SSH-1.0-SSH_Version_Mapper. Don't panic." in syslog"

    hi ya loki
    
    you folks probably know this but...thought i'd post it
    for some of us... and am hoping i can get some more links
    and references too
    
    you can check if you are vulnerable to icmp smurf attacks...
    	http://www.netscan.org
    	http://www.powertech.no/smurf/
    
    donno if there is a dns smurf test site
    	??
    	
    online dns testing
    	http://www.Linux-Sec.net/audit/audit_tools.gwif.html#DNS
    
    have fun
    alvin
    
    On Mon, 24 Dec 2001, Bill Royds wrote:
    
    > DNS can be used as an amplifier for a "smurf" type attack, which seems to be the case here.
    > What an attacker does is send a large series of DNS requests to many fast server, with the victims address as the return address.
    >   Since DNS queries are UDP, there is no connection needed. The return packets are very much larger than the query, so a few K worth of queries returns megabytes worth of answers, all directed at the victim, not the perpetuator.
    > The attacker has to chose the sites to query carefully to maximized the attack. She wants to have a large packet returned but not more than the MTU (about 1500 bytes). If it is more than MTU, the DNS server will attempt to initiate a TCP format query, which fails. 
    > 
    > It is using a DNS server in your range to maximize the bandwidth amplification, so I would suggest looking at the server that is apparently attacking you and asking it to pace replies to you to avoid the attack. Another tactic is to ask bandwidth limit replies to you.
    > Both of these IP's are victims, although yours gets the effect of amplification more. 
    > 
    > -----Original Message-----
    > From: Loki [mailto:lokiat_private]
    > Sent: Mon December 24 2001 14:31
    > To: incidentsat_private
    > Subject: NT Compromise -- Update -- SRC PORT: 53 traffic
    > 
    > 
    > I should mention that the packets were flooding our DNS server, enough
    > traffic to saturate and bring down our T1. Please note that again, the
    > port 53 was not the DST port, rather, the SRC port of each packet.
    > 
    > 
    > -- 
    > 
    > 
    > ============================================================
    > Loki
    > Founder, Chief Research Scientist
    > Fate Research Labs
    > United States VPN Division
    > ------------------------------------------------------------
    > [w] http://www.fatelabs.com
    > [e] lokiat_private
    > [p] +1 412 303 3115
    > ------------------------------------------------------------
    > "Ipsa Scientia Potestas Est" Knowledge itself is power.
    > ============================================================
    > 
    > 
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management 
    > and tracking system please see: http://aris.securityfocus.com
    > 
    > 
    > ----------------------------------------------------------------------------
    > This list is provided by the SecurityFocus ARIS analyzer service.
    > For more information on this free incident handling, management 
    > and tracking system please see: http://aris.securityfocus.com
    > 
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Dec 26 2001 - 16:57:07 PST